Security readiness

• Threat model reviewed
• Secrets excluded from repository and images
• Administrative access authenticated and logged
• Key rotation and compromise response tested
• Dependency and container scanning enabled